Residential proxy exits detected on White House network, security firm reports

Commercial residential proxy services were routing traffic out of the network that hosts the White House, according to security firm Layer3 Intel. The company says its newly launched Residential Proxy Observatory recorded proxy exit activity on AS2650, an address block registered to the Executive Office of the President, on 26 of the 30 days between October 5 and November 3, 2026. The findings appeared in a company blog post that reached the front page of Hacker News this week.

What the observatory saw

Layer3 Intel's enumeration pipeline works by buying ordinary rotating access from residential proxy services and logging where the requests emerge. Over the month-long window, the firm says this pipeline exited through the White House network 236 times, spread across six addresses, and that 28 separate proxy services were able to route traffic out of the block.

The company stresses that it made no effort to target the network; the exits surfaced while using the standard global product that anyone can purchase for a few dollars. To rule out an artifact of its own methodology, Layer3 Intel compared its results against two independent detection services, Spur and Synthient, and says both classify the same addresses as residential proxy exits.

Residential proxy services sell access to everyday devices: customers send their traffic through them so it appears to originate from the device's own network. The relay capability typically comes from an SDK embedded in software running on the device, which is why Layer3 Intel frames the White House activity as an infection rather than a deliberate configuration.

Why the timing matters

Nearly half of the observed exits occurred between 5 p.m. and midnight Eastern time, with almost no activity in the early morning. Layer3 Intel reads that rhythm as the signature of a person rather than an open guest network: someone regularly present on the White House network in the evenings, carrying a device that runs a proxy SDK.

The firm is explicit about the limits of its data. It can see the exit traffic, not the device or the individual behind it. It says it has backed up the raw logs and will share them with relevant agencies on request. The claims have not been independently verified.

The deeper worry, according to Layer3 Intel, is what a compromised exit node could expose. Citing earlier Synthient research on a botnet dubbed Kimwolf, which reached at least two million devices, largely Android hardware with an exposed ADB service, through residential proxy networks, the firm notes that flawed proxy SDKs have historically opened paths into internal networks and enabled lateral movement. If a similar flaw exists on a device inside the White House network, anyone buying proxy access could potentially use it to probe inward.

A global footprint

The White House was not the observatory's only unusual finding. Layer3 Intel also recorded proxy activity in some of the most isolated networks on the planet. On Saint Helena, the South Atlantic territory that includes the world's most remote inhabited island, it logged 413 addresses and more than 32,000 observations, split between Starlink and the local provider Sure Saint Helena. Three observations came from Antarctica, all tied to a Cloudflare WARP address pointing at McMurdo Station. Single connections appeared on Pitcairn, Norfolk Island and in Longyearbyen on Svalbard, alongside larger counts in the Falkland Islands, with 388 addresses, the Chagos Islands with 43, Tokelau with 21 and South Georgia with 7.

Why it matters

If the findings hold up, they show that the residential proxy economy reaches even the most closely guarded networks, and that the barrier to entry is a small subscription rather than a sophisticated attacker. The exposure runs in both directions: exit traffic leaking from a sensitive network reveals that compromised devices exist inside it, and prior research on proxy SDKs suggests such software can be leveraged for internal access and lateral movement, the same mechanism botnets have used to spread. For security teams everywhere, the episode is a reminder to monitor egress for traffic that should not exist and to treat the app inventory on devices in sensitive environments as part of the attack surface. The claims, however, rest on a single vendor's telemetry, and until an official review confirms them they should be read as plausible but unverified.